220-1002 · Question #383
A corporate fileshare holds files for multiple departments. Individual users in each department create reports that are meant to be read by the rest of the company. Recently, a user ran a malicious…
The correct answer is D. Use a host-based intrusion detection system and continuously monitor filesystem changes. A host-based intrusion detection system (HIDS) that monitors filesystem changes in real time can detect the rapid, mass encryption pattern characteristic of ransomware. Upon detection, automated alerts or responses can stop the malicious process before all files are encrypted…
Question
A corporate fileshare holds files for multiple departments. Individual users in each department create reports that are meant to be read by the rest of the company. Recently, a user ran a malicious executable that encrypted all of the documents on the fileshare. The software asked for money to be transferred via cryptocurrency in order to decrypt the files; however, the files were not decrypted after the company paid the ransom. Which of the following would MOST likely minimize the damage to a fileshare in this type of situation?
Options
- AEnable System Restore on the file server and make frequent restore points.
- BDisable full disk encryption on the file server.
- CInstall a next-generation firewall at the network edge.
- DUse a host-based intrusion detection system and continuously monitor filesystem changes.
- EUse granular file permissions on the share and follow the principle of least privilege.
How the community answered
(18 responses)- A6% (1)
- B22% (4)
- C11% (2)
- D56% (10)
- E6% (1)
Explanation
A host-based intrusion detection system (HIDS) that monitors filesystem changes in real time can detect the rapid, mass encryption pattern characteristic of ransomware. Upon detection, automated alerts or responses can stop the malicious process before all files are encrypted, minimizing damage. System Restore points can be corrupted by ransomware. Disabling full disk encryption actually reduces security. A perimeter firewall does not stop malware already inside the network. Least-privilege permissions (E) reduce the blast radius but do not actively detect or stop an ongoing attack the way continuous HIDS monitoring does.
Topics
Community Discussion
No community discussion yet for this question.